Rush University Medical Center Notifies 45,000 Patients of PHI Incident
Rush University Medical Center is notifying approximately 45,000 patients that their PHI has been exposed as a result of a data incident at a financial services vendor. Rush learned of the incident on January 22, 2019.
An employee of the financial services vendor was discovered to have disclosed a file containing patients’ PHI to an unauthorized third party in May 2018. The types of information in the file varied from patient to patient and may have included names, home addresses, dates of birth, health insurance information, and Social Security numbers. No health information was contained in the file and financial data was not exposed.
Rush conducted an investigation into the breach and while no evidence was found to suggest patient information had been misused, affected patients have been offered membership to the Experian IdentityWorks Credit 3B service to protect against identity theft and fraud as a precaution.
Affected patients have been advised to monitor their financial accounts and explanation of benefits statements from their insurers for any sign of fraudulent activity. All affected patients were notified of the breach by mail on February 25, 2019.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
After discovering the breach, Rush suspended its contract with the financial services vendor and the incident has been reported to law enforcement. Steps have now been taken to prevent similar breaches from occurring in the future, including increasing oversight of service vendors, and reviewing and enhancing internal policies, processes, and procedures for contracting third-party firms.
This is the second privacy breach to be reported by Rush in 2019. In February, patients were sent letters to inform them about the retirement of a nurse practitioner at its Epilepsy Center; however, an error in the mailing resulted in 908 letters being sent to incorrect recipients.
